Digital evidence storage for legal matters is a common practice. As
the use of Solid State Drives (SSD) in consumer and enterprise
computers has increased, so too has the number of SSDs in storage
increased. When most, if not all, of the drives in storage were
mechanical, there was little chance of silent data corruption as long
as the environment in the storage enclosure maintained reasonable
thresholds. The same is not true for SSDs.

A stored SSD, without power, can start to lose data in as little
as a single week on the shelf.

SSDs have a shelf life. They need consistent access to a power
source in order for them to not lose data over time. There are a
number of factors that influence the non-powered retention period that
an SSD has before potential data loss. These factors include amount of
use the drive has already experienced, the temperature of the storage
environment, and the materials that comprise the memory chips in the
drive.

The Joint Electron Device Engineering Council (JEDEC) defines
standards for the microelectronics industry, including standards for
SSDs. One of those standards is an endurance rating. One of the
factors for this rating is that an SSD retains data with power off for
the required time for its application class.

For client application SSDs, the powered-off retention period
standard is one year while enterprise application SSDs have a
powered-off retention period of three months. These retention periods
can vary greatly depending on the temperature of the storage area that
houses SSDs.

In a presentation by Alvin Cox on JEDEC's website titled "JEDEC
SSD Specifications Explained" [PDF warning], graphs on slide 27
show that for every 5 degrees C (9 degrees F) rise in temperature
where the SSD is stored, the retention period is approximately halved.
For example, if a client application SSD is stored at 25 degrees C (77
degrees F) it should last about 2 years on the shelf under optimal
conditions. If that temperature goes up 5 degrees C, the storage
standard drops to 1 year.

The standards change dramatically when you consider JEDEC's
standards for enterprise class drives. The storage standard for this
class of drive at the same operating temperature as the consumer class
drive drops from 2 years under optimal conditions to 20 weeks. Five
degrees of temperature rise in the storage environment drops the data
retention period to 10 weeks. Overall, JEDEC lists a 3-month period of
data retention as the standard for enterprise class drives.

A check of various drive manufacturers, in this case Samsung,
Intel, and Seagate, shows that their ratings for data retention of
their consumer class drives are what would be expected for JEDEC's
enterprise class drive standards. All three quote a nominal 3-month
retention time period. Most likely, the manufacturers are being
conservative; however, it demonstrates the potential variability the
manufacturers associate with data retention on any SSD in storage.

When you receive a computer system for storage in legal hold, drive
operating and ambient storage temperature are probably not the first
things on tap to consider. You cannot control the materials that
comprise the drive and the prior use of the drive. You can control the
ambient temperature of the storage which will potentially aid in data
retention. You can also ensure that power is supplied to the drives
while in storage. More importantly, you can control how the actual
data is retained.

The easiest way to manage the problem is to image the drive in a
timely manner. If long term storage is required, image the SSD onto a
mechanical drive and place that drive in storage as well as the SSD.
If you maintain an online legal hold storage capability, image the SSD
to that storage. Either way, you essentially eliminate potential data
retention problems. The worst-case scenario is explaining to the court
why your data cannot be accessed because the hard drive you placed
into storage is throwing out errors.

What started this look into SSDs? An imaging job of a laptop SSD
left in storage for well over the 3-month minimum retention period
quoted by the manufacturer of the drive before it was turned over to
us. This drive had a large number of bad sectors identified during the
imaging period. Not knowing the history, I did not consider the
possibility of data loss due to the drive being in storage. Later, I
learned that the drive was functioning well when it had been placed
into storage. When returned to its owner a couple of months after the
imaging, the system would not even recognize the drive as a valid boot
device. Fortunately, the user data and files were preserved in the
drive image that had been taken, thus there was no net loss.

Now imagine a situation in which an SSD was stored in legal hold
where the data was no longer available for imaging, much less use in
court. Ignorance of the technology is no excuse, and I am sure the
opposing counsel would enjoy the opportunity to let the court know of
the "negligent" evidence handling in the matter.